fix(cli): add update check mode

[MadKangYu]

Summary

• add a read-only hermes update --check mode that reports update status without mutating the checkout
• report status for both official checkouts and forks with upstream configured
• document the new check mode in the update guide and CLI reference
• fix the Linux systemd update-restart test to patch is_linux explicitly on macOS runners

Behavior

• hermes update --check does not pull
• hermes update --check does not install dependencies
• hermes update --check does not migrate config
• hermes update --check does not restart the gateway

Notes

• This PR introduces the new interface/behavior.
• fix(cli): prefer active checkout for update banner #7303 is the runtime-split follow-up that fixes update banner repo resolution for multi-checkout setups.

Testing

• cd /Users/yu/.hermes/hermes-agent-update-check && /Users/yu/.hermes/hermes-agent/venv/bin/python -m pytest -q tests/hermes_cli/test_cmd_update.py tests/hermes_cli/test_cmd_update_check.py tests/hermes_cli/test_update_check.py tests/hermes_cli/test_update_gateway_restart.py
• result: 45 passed

[MadKangYu]

Maintainer note: local targeted verification for this branch is green on the update-related scope. Command run: pytest -q tests/hermes_cli/test_cmd_update.py tests/hermes_cli/test_cmd_update_check.py tests/hermes_cli/test_update_check.py tests/hermes_cli/test_update_gateway_restart.py. Result: 45 passed. The failing GitHub test run looks like broader repo baseline instability involving AIAgent.request_overrides, GatewayRunner._session_model_overrides, voice-mode failures, and config-version failures rather than a regression from the read-only hermes update --check change set here. The failing docs-site-checks job is also currently tripping repo-wide docs lint outside the changed paths in this PR.

[teknium1]

This is an automated hermes-sweeper review.

The hermes update --check read-only mode introduced by this PR has since been implemented on main via a separate commit.

• Implementation commit: dc5e02ea7 — feat(cli): implement hermes update --check flag (fixes #10318)
• _cmd_update_check() function: hermes_cli/main.py line 5911 — fetches from origin, counts commits behind, reports status without pulling/installing/migrating/restarting
• --check argparse flag: hermes_cli/main.py line 9446 — help='Check whether an update is available without installing anything'
• Dispatch logic: hermes_cli/main.py line 6054 — if getattr(args, 'check', False): _cmd_update_check(); return

The core feature this PR adds is fully covered. The secondary fixes bundled in this PR (test isolation for is_linux on macOS, CI-baseline fixes) may warrant a separate review if not already addressed.